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SUPERIOR COURT OF THE STATE OF CALIFORNIA 


■ | SIX4THREE LLC, 
Plaintiff 

I vs - 

; FACEBOOK, INC., et al. 
Defendants. 


COUNTY OF SAN MATEO 


Case No. CIV533328 

REPORT OF STROZ FRIEDBERG 
DATED MARCH 12, 2019 

Assigned for All Purposes to 
Hon. V. Raymond Swope, Dept. 23 

Dept.: 23 

Action Filed: April 10,2015 


1. Stroz Friedberg has been retained by Facebookto serve as a forensic investigator 
in the above-captioned matter, and this report responds to the Court's Case Management Order 
Number 19, dated March 1, 2019. That order directed Stroz Friedberg to perform as follows: 


[C]onduct a search on Mr. Kramer's computer, currently in its possession, for 
any and all logs and records, not limited to systems logs, that will identify any 
files accessed, opened, uploaded, downloaded, transferred, shared, saved, 
modified, and/or deleted, for the period from November 19, 2108 1 at 12:00:00 
AM (GMT) to November 23, 2018 at 11:59:59 P.M (EST). Stroz Friedberg shall 
not open any files on Mr. Kramer's computer absent further of the Court. 


Stroz Friedberg shall serve on counsel of record a written summary and attach 
the logs and records promptly upon completion. The Court considers this 
report confidential information under the protective order and should be 
treated as such. 2 

This report summarizes Stroz Friedberg's compliance with this Court's order. 


1 Stroz Friedberg assumed that the intended year is 2018. 

2 Case Management Order No. 19, at p3 (March 1, 2019). 
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2. Stroz Friedberg, an Aon Company, is an international consulting and technical 
services firm specializing in digital risk management, including data breach and cybercrime 
response, digital forensics, electronic discovery, and business-intelligence services and 
investigations. Stroz Friedberg's management includes former federal and state prosecutors and 
former law enforcement officers with both governmental and private-sector experience in 
traditional and cyber-based investigations, digital forensics, data preservation and analysis, 
infrastructure protection, and electronic discovery. 

3. On November 30, 2018, under direction from this Court, Stroz Friedberg imaged a 
MacBook Pro with serial number C025F3PFIGY25. It was represented to Stroz Friedberg that this 
MacBook Pro belonged to Theodore Kramer. Pursuant to this Court's Order of March 1, Stroz 
Friedberg performed a limited-scope forensic analysis of that MacBook. In that analysis, Stroz 
Friedberg reviewed any and all logs and records for evidence that any files were accessed, 
opened, uploaded, downloaded, transferred, shared, saved, modified, and/or deleted for the 
period from November 19, 2018 at 12:00:00 AM GMT to November 23, 2018 at 11:59:59 PM EST 
(the "Court-Ordered Date Range"). Stroz Friedberg did not open any user-created files on Mr. 
Kramer's computer. 

4. File-listing spreadsheet. Stroz Friedberg created a spreadsheet listing all files 
containing metadata values in the fields File Created, Last Modified, or Last Accessed during the 
Court-Ordered Date Range. An electronic version of the spreadsheet has been provided with this 
report. 

5. USB artifacts and Dropbox artifacts. In addition to creating the file listing, Stroz 
Friedberg also complied with the Court's order to analyze "any and all logs and records" relating 
to "uploaded, downloaded, transferred, [or] shared" by reviewing forensic artifacts on the 
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MacBook for (1) any evidence of USB activity and (2) any evidence of access to the cloud storage 
utility Dropbox. 

6. The paragraphs below describe Stroz Friedberg's methodology to perform the 
above-described tasks. 

Date-range file-listing methodology 

7. Stroz Friedberg analyzed the MacBook Pro by finding all files on the system with a 
File Created timestamp during the Court-Ordered Date Range. Stroz Friedberg also exported file 
listings for all files that had either a Last Modified timestamp or a Last Accessed timestamp 
between those dates. Stroz Friedberg then consolidated those listings into a single spreadsheet — 
including the tabs (1) All Files, (2) User Docs, and (3) PDF Files — as described in more detail 
below. The creation of the All Files tab is described in paragraphs 8 to 11 , below. 

8. File Created. The file listings (i.e., metadata only) for the relevant File Created 
timestamps were opened in Microsoft Excel. The entries were sorted by their File Created 
timestamps. The utilized tool placed all timestamps in the GMT time zone. So each timestamp 
was converted from GMT to EST by subtracting five hours from the GMT times. The converted 
timestamps were saved in their own columns. Stroz Friedberg then deleted all file entries with a 
corresponding File Created timestamp value outside of the Court-Ordered Date Range. 
Specifically, Stroz Friedberg deleted all file listings with a File Created timestamp value that that 
was: 

a. before this date —11/19/2018 12:00:00 AM GMT 

b. and after this date: 11/23/2018 11:59:59 PM EST. 
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So for this first iteration of the spreadsheet, the only file listings that remained were those 
between the above-listed dates. That first iteration was augmented by the Last Modified and Last 
Accessed processes described below. 

9. Last Modified and Last Accessed. Stroz Friedberg performed the same date-range 
filtering for the file listings based on the file timestamps Last Modified and Last Accessed. 

10. Consolidation. All entries were then copied from the three file listings into a 
single spreadsheet, deduplicating entries by comparing all fields. The first tab of the provided 
spreadsheet contains a listing of the entire universe of files that had a timestamp within the 
Court-Ordered Date Range. 

11. Path column. Originally, the Path column contained the full path information, 
including the file name. To permit searching and filtering of all files in a specific path, an Excel 
formula was run on the Path column, removing filenames. After that process, a user can now filter 
the spreadsheet to: 

a. include only those files that are listed within user-specified path(s). 

(E.g., user-created directories) 

b. exclude likely irrelevant files that are contained within specified path(s). 

(E.g., directories created by macOS.) 

User 
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a. All file listings not found in a user directory were deleted first. 

b. Of the remaining file listings within a user directory, all file listings with a 
file extension not known to be user-created were also deleted. 

c. That left only file listings with extensions typical of user-created files (e.g., 
PDF, Microsoft Word files, Microsoft Excel files). 

13. Tab of PDF Files. Lastly, to create a tab that contained only PDF files, the User 
Documents tab was copied to a third tab: PDF Files. In that third tab, all file listings that did not 
have a .PDF extension were deleted, leaving only the PDF files. 

14. The attached spreadsheet contains file listings within the Court-Ordered Date 
Range. If the Court would like Stroz Friedberg to perform additional analyses, that spreadsheet 
may be supplemented. 

USB artifact review methodology and findings 

15. Stroz Friedberg next sought to comply with the Court's order to analyze "any and 
all logs and records" relating to "uploaded, downloaded, transferred, [or] shared" by reviewing 
forensic artifacts on the MacBook for any evidence of USB drive activity. The first action taken in 
this USB review was to export settings and configuration files that are known to contain 
information about removable media (e.g., USB flash drives, external hard drives) volumes on 
macOS. 
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Dropbox artifact review methodology and findings 

20. Stroz Friedberg next sought to comply with the Court's order to analyze "any and 
ail logs and records" relating to "uploaded, downloaded, transferred, [or] shared" by analyzing 
the device image for any evidence of Dropbox activity within the Court-Ordered Date Range. 
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